Reviewed October 20, 2026 against source
67bc2370. Controller/TypeScript SDK 2.12.0
and CLI 3.3.0 belong to the v2.12.0-rc.2 candidate work; Sandbox MCP is 0.3.0 and
Python SDK 2.7.0 has its own surface. Source tags, package publication, image promotion,
and hosted deployment are separate. The retained hosted inventory identifies v2.10.1;
newer features require their own deployment/capability checks.
The reviewed working tree also contains later, uncommitted RC3 image-hardening work;
its local scan evidence is separate from the published RC2 image.Choose the unit of work
Lifecycle and identities
Keep sandbox, execution, process, task, and artifact IDs separately. An HTTP response, a zero process exit, an accepted stop, and a correct task result establish different facts. Unknown execution outcomes are retained explicitly; a dropped connection is not permission to repeat a mutation. Capture request bodies and supported idempotency keys before dispatch. Startup wait, command timeout, and sandbox lifetime are separate budgets. Cold provisioning can consume part of the lifetime. Non-durable lifetime remains plan-limited beneath a 24-hour platform cap; enabled durable plans have separate limits. Use returned expiry/headroom fields rather than assuming every plan or deployment supports the same duration.Access and isolation
API keys useAuthorization: ApiKey <key>; JWTs use Bearer. Registration requires email
verification before a usable API key is issued. Organization, scopes, sandbox roles, and
pod/process identity constrain access; a task-family grant does not grant sandbox execution.
Admitted runtime levels are container, gvisor, microvm, and kata. Availability depends
on RuntimeClasses, node configuration, and the deployment allowlist. WebAssembly is not an
available runtime in the reviewed controller. See runtime selection.
Latest reliability work
The candidate adds client-only startup budgets, shared PostgreSQL tunnel records, explicit cross-caller tunnel keys, artifact expiry/integrity checks, metadata-only audit events, and conservative CLI mutation handling. A matching active tunnel can replay under current authorization; stale receipts remain reserved instead of creating a replacement. Prepared tasks retain private launch journals, exact command/process identities, input hashes, and output observations. Registered teams let a fresh authorized parent discover workers without sharing launch journals; private control and result receipts remain separate.Evidence scope
The source retains an October 20 funded hosted lifecycle returning385, exit zero, API
retirement, and zero remaining pods. It also retains a cold-node failure; one warm success
is not a cold-start or capacity SLO. The candidate’s local tests/image transport checks do
not establish hosted promotion, independent security acceptance, fleet scale, or regional HA.
The published RC2 review reports zero fixable HIGH/CRITICAL findings, no CRITICAL findings,
and 43 unfixed HIGH package findings across eight CVEs. Later uncommitted RC3 work reports
zero HIGH/CRITICAL findings in its local image scan and 14 offline bootstrap checks.
Publication, hosted CI, independent review, and rollout acceptance remain separate gates.
Use operations and release evidence
when deciding what is qualified.
Start with one verified runtime or
the TypeScript SDK.